> I've never ever seen a cookie notice on HN, which is legally required.

What for? The GDPR does not require consent for purely functional cookies, and the only data I see stored is my account cookie. So the existing privacy policy should cover them.